How the exposed files check works
Files left in a website's public folder can be downloaded by anyone who knows the name: a settings file with database passwords, a database dump, a backup of the whole site. Automated attack tools try these names on every site they find. This check tries a short, fixed list of them first, so you hear about it from us.
What it reads
- One request per address on a fixed list of well-known file names, under 30 in total. The full list is on the methodology page, generated from the scanner's code. There is no guessing from word lists.
- Redirects are not followed, so a site that sends unknown addresses to its home page is not mistaken for one that serves the file.
/.well-known/security.txt, the standard place for a security contact.
What it reports
A file is only reported when the response carries the content signature of that file type. An ordinary page served at /.env, or a "page not found" with status 200, is not a finding. Examples:
.envsettings files and their backups (lines likeDB_PASSWORD=...)..gitand other version-control folders, which can expose your whole source code.- Database dumps (
backup.sql,dump.sql), backup archives and WordPresswp-config.phpbackups. - Diagnostic pages such as
phpinfo(), server status pages, debug logs and database admin tools. composer.jsonandpackage.json, which list the components your site is built from.- A missing
security.txt, as information.
What it cannot see
- Files with names that are not on the list. That is the price of not guessing.
- Whether a file was already downloaded by someone else before the check.
What to do with the result
Remove the file from the public folder, or block the address in the server configuration. If the file held passwords or keys, change them: treat anything that was public as known to others. Database dumps and settings files are critical and should be handled the same day.
See what this looks like on your own site: a free, passive check in about two minutes.
Check my websiteEverything this check can report
- Critical.env file publicly readable
- Serious.git repository metadata publicly readable
- SeriousVersion control metadata publicly readable
- Minor.DS_Store file publicly readable
- SeriousBackup archive publicly readable
- CriticalDatabase dump publicly readable
- CriticalWordPress configuration backup publicly readable
- CriticalConfiguration backup publicly readable
- Seriousphpinfo() page publicly accessible
- ModerateServer status page publicly accessible
- ModerateDebug log publicly readable
- Minorcomposer.json publicly readable
- Minorpackage.json publicly readable
- ModerateDatabase admin tool publicly accessible
- ModerateDiagnostic trace page publicly accessible
- InfoNo security.txt
- InfoSome well-known paths were not checked
Severity is fixed per finding in our code and never set by the AI that writes the report text. How severity becomes a score is on the methodology page.
The other checks
- How the security headers check works · The instructions your server sends to browsers with every page.
- How the cookies check works · Whether the cookies your site sets are protected on the way and in the browser.
- How the secure connection check works · Your certificate, the encryption your server accepts, and whether visitors are moved to https.
- How the email and DNS check works · The public DNS records that stop fake email in your name, and addresses pointing to services you no longer use.
- How the technology check works · What your site is built with, worked out from what it shows publicly.
- How the vulnerability wave check works · Whether what we can see matches a major vulnerability in the news.